Legal Tech News

A zero-authentication vulnerability in Notion allows anyone to extract the full names, email addresses, and profile photos of users who have edited a public page. The issue requires no login or tokens, as a single POST request returns all sensitive contributor data. This flaw poses a significant privacy risk for organizations utilizing public company wikis, potentially exposing the personal information of their entire workforce.

Vercel disclosed a security breach impacting its internal systems that came to light on Sunday. The company has brought in an incident response provider to investigate the intrusion, though specific details regarding the scope of the attack remain scarce.

A newly identified vulnerability in the iTerm2 terminal emulator allows attackers to turn a simple "cat readme.txt" command into arbitrary code execution. By exploiting how the application processes terminal output, hackers can weaponize seemingly harmless file reads to run malicious scripts.

The latest edition of the Seriously Risky Business cybersecurity newsletter, now published on Lawfare, advocates for a strict ban on the commercial sale of precise geolocation data. The piece highlights the significant privacy and national security threats posed when data brokers sell highly accurate location tracking information to potentially malicious actors.

A newly proposed US bill contains a hidden mandate requiring on-device age verification for consumer electronics. This sweeping provision would apply to every laptop, gaming console, smart TV, and car infotainment system in the country.

Codex successfully compromised a Samsung smart TV after being provided with an initial system foothold. It quickly escalated its privileges to pop a root shell, gaining full administrative control over the device. This demonstration highlights the tool's capability to execute a complete system takeover on consumer electronics.

The Free Software Foundation is seeking a direct human contact at Google to report a Gmail account responsible for sending over 10,000 spam emails. The organization is appealing to the tech community for help bypassing its standard abuse reporting forms, which have previously failed to generate any response or resolution.

Newly unsealed documents from California's antitrust lawsuit against Amazon reveal alleged price-fixing tactics used by the tech giant. The state's Attorney General claims these records demonstrate how Amazon manipulated prices, though the company firmly denies any illegal pricing practices.

A new technique dubbed RedSun grants SYSTEM-level access on Windows 11, 10, and Server, underscoring the security risks of antivirus software operating with full system privileges. Discussions surrounding the issue emphasize that allowing tools like Windows Defender to run as SYSTEM creates massive attack surfaces ripe for privilege escalation exploits. Security advocates argue that Microsoft should handle core system-level scanning natively while restricting antivirus remediation components to lower-privilege, sandboxed environments.

YC W26 startup Kampala allows developers to reverse-engineer private applications into usable APIs by analyzing network traffic and HAR files. Reader discussions highlight the tool's utility for building custom automations, but also note challenges such as mobile SSL pinning and potential terms of service violations. The creators clarified that the platform is designed to facilitate personal automation workflows rather than enable mass-scale scraping.

Google has broken its nearly decade-long promise to notify users before handing their data to law enforcement. The company recently provided user Amandla Thomas-Johnson's information to ICE without prior warning, depriving him of the opportunity to challenge the subpoena.

A jury has ruled that Live Nation illegally monopolized the ticketing market, culminating in a landmark antitrust trial after years of regulatory scrutiny. The verdict now sets the stage for a potential breakup of the largest US concert promoter and ticket seller.

Discussions surrounding the deployment of Flock license plate recognition cameras highlight a deep divide over their effectiveness in addressing public safety concerns. Critics argue the surveillance technology masks broader police inefficiencies and ignores the root causes of crime. Conversely, proponents maintain the systems provide crucial investigative tools that help solve crimes in struggling cities.

Spotify and several major record labels have secured a $322 million default judgment against the piracy site Anna's Archive. The case concluded without a fight because the operators of the shadow library remain unknown and did not respond to the lawsuit.

A New York federal court has ruled that conversations with AI chatbots do not qualify for attorney-client privilege because sharing data with a third-party service eliminates the expectation of confidentiality. The decision relied on the terms of service to classify the interactions as discoverable personal notes rather than protected legal communications. This ruling highlights the growing legal gap between consumer expectations of digital privacy and the realities of using artificial intelligence tools.

A California resident invoked the state's Consumer Privacy Act to demand that surveillance company Flock delete all personal and vehicle data from its databases. The individual formally revoked consent for the company to collect their information in the future. Flock has since responded to the privacy inquiry.

California’s proposed bill AB 2047 would mandate censorware on all 3D printers and criminalize the use of open-source alternatives. Critics warn that the legislation will stifle technological innovation and introduce severe consumer harms like surveillance and platform lock-in. Advocates are urging the state to reject the bill, arguing that it merely repeats the historical failures of digital rights management.

Fiverr is facing severe criticism after a security flaw left sensitive customer files, including tax returns and Social Security numbers, publicly searchable via Google for nearly a week. Although the company claimed the documents were uploaded with explicit user consent as work samples, affected users dispute this and stress the severe privacy risks posed to vulnerable individuals using the platform. The leaked files were recently blocked by the hosting provider, but the prolonged exposure has sparked widespread outrage over the marketplace's data protection practices.

Spain plans to expand dynamic internet blocking during live sports and movie broadcasts to combat piracy, a strategy critics argue causes collateral damage by inadvertently restricting access to legitimate websites. In response to these aggressive measures and the sports industry pushing to ban consumer VPNs, digital rights advocates are calling for stricter EU-level intervention. They argue that broad IP-based restrictions violate net neutrality principles and set a dangerous precedent for internet freedom and user privacy across the European Union.

The 5th U.S. Circuit Court of Appeals has declared a nearly 158-year-old federal ban on home distilling unconstitutional. This ruling removes longstanding restrictions on individuals producing their own spirits at home and could spur new innovations in small-scale distillation equipment.

Google's latest Android update strips location metadata from photos when users upload them through web browsers, breaking functionality for mapping sites like OpenBenches. This change prevents developers from using embedded geolocation data to accurately place user-submitted images on a map.

A newly compiled archive details a staggering timeline of major cybersecurity breaches that have largely flown under the radar this year. By documenting these underreported hacks, the collection sheds light on the escalating and often overlooked digital threats facing modern organizations.

Michigan lawmakers withdrew proposed digital age legislation following backlash over its handling of consumer data privacy. Critics argued the bills relied on flawed opt-out mechanisms rather than requiring strict opt-in permission for data sales. The controversy highlights broader frustrations with tech companies using delayed consent models to harvest user data for AI training without explicit approval.

The final installment of a tech series explores AI safety and alignment, arguing that trusting commercial or government entities to align AI systems with individual goals is inherently dangerous. Reader discussions highlight the adversarial nature of these power dynamics, emphasizing how concentrated institutional power actively undermines natural human cooperation to prioritize corporate and governmental interests.